Privacy Policy

Soap (“we,” “our,” “us”) is committed to protecting the privacy of therapists, clinicians, and their clients. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws in Canada. This Privacy Policy explains how we collect, use, store, and safeguard personal information when you use our platform.

1. Information We Collect

When you use Soap, we may collect the following types of information:

• Account Information: Name, email address, login credentials.
• Professional Information: Practice details, business information, and payment details.
• Client Data: Notes, invoices, session details, and related records that you input into the platform.
• Usage Data: Technical information such as IP address, browser type, and interaction with our platform.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve our services.
• Allow therapists and clinicians to manage invoices, session notes, and client records.
• Process payments and send billing notifications.
• Communicate with you regarding updates, support, or service changes.
• Ensure security, prevent fraud, and comply with legal obligations.

3. PIPEDA Compliance

As required under PIPEDA:

• We only collect, use, and disclose personal information with knowledge and consent, except where otherwise permitted by law.
• We limit collection to what is necessary for the purposes identified in this Privacy Policy.
• We safeguard personal information with appropriate technical, administrative, and physical security measures.
• We ensure accuracy and allow individuals to access, correct, or withdraw consent regarding their personal information.
• We are accountable for personal information in our control, including information transferred to third-party service providers.

4. Data Storage & Security

• All data is stored securely using encryption and industry-standard safeguards.
• Access to client data is restricted to authorized users only.
• We do not sell, rent, or trade personal information to third parties.

5. Sharing of Information

We may share information only in the following cases:

• With service providers who support our platform (e.g., secure hosting, payment processors).
• When required by law or legal process.
• With your explicit consent.

5.1 Third-Party Integrations

Soap integrates with select third-party services to enhance functionality, such as scheduling and communication. These integrations use secure OAuth or API connections, and we only share necessary information with your explicit consent during setup. Data is processed transiently for the integrations purpose and not retained or shared beyond that. Below are our current integrations:

• Zoom: Used for creating and scheduling virtual sessions. We request access to your Zoom profile (name, email) for personalization and meeting creation (topics, times, join links). This data is used in real-time to generate links and is not stored long-term or shared externally. Tokens are encrypted and deleted upon disconnection.
• Google: For calendar synchronization and authentication. We access calendar events and basic profile info (email) to import sessions. No client details are shared; data is synced temporarily and removed on request.
• Calendly: For automated booking. We connect to pull availability and create events, sharing only scheduling details (e.g., time slots) without sensitive client notes.
• Klaviyo: For email notifications and marketing. We share contact info (email) for billing reminders or updates, with opt-out options at any time. No session or client data is included.

For all integrations, consent is obtained during authorization, and you can revoke access via Soap settings or the providers dashboard. See Section 6 for exercising rights over this data.

6. Your Rights

In line with PIPEDA, you have the right to:

• Access and update your personal information.
• Request correction of inaccurate information.
• Withdraw consent for the use or disclosure of your information, subject to legal or contractual restrictions.
• Request deletion of your data (where legally permitted).

7. Data Retention

We retain data only as long as necessary to provide our services or comply with legal obligations. Therapists and clinicians may manage or delete their records at their discretion.

8. Children’s Privacy

Soap is intended for licensed professionals. We do not knowingly collect personal information directly from minors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted here with an updated “Last Updated” date.

10. Contact Us

If you have any questions about this Privacy Policy, or about our compliance with PIPEDA, pleaseContact us

• Business Address: 390 Cherry St, Toronto, Ontario